Analysis
- max time kernel
179s - max time network
187s - platform
android_x64 - resource
android-x64-20240514-en - resource tags
- submitted
29/05/2024, 22:24
General
- Target 8225c6d10364ed5f61e48dc78fde946c_JaffaCakes118.apk
- Size 4.2MB
- Sample240529-2bepyada43
- SHA256 013e87fd689f7e85167626a8a1841b34f715245e631436d8ddd32da7252892c1
Malware Config
Signatures
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
- Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
- Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
- Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
- Checks if the internet connection is available 1 TTPs 2 IoCs
- Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Reads information about phone network operator. 1 TTPs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
Processes
-
io.dcloud.H5FD951661⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
io.dcloud.H5FD95166:pushservice1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
pushsdk.db
pushsdk.db-journal
.imei.txt
test_app
.imei.txt
about.html
feedback-page.css
list-to-detail.css
mui.css
mui.min.css
mui.picker.css
mui.poppicker.css
style.css
editPass.html
iconfont.css
iconfont.ttf
mui.ttf
Wangminliuyan-login.png
echars.png
iconfont-tianjia.png
qihoo.png
qq.png
red.png
sinaweibo.png
wangmin-login.jpg
wangmin-login.png
weixin.png
yellow.png
app.js
common.js
echarts.js
feedback-page.js
feedback.js
format.js
mui.enterfocus.js
mui.js
mui.locker.js
mui.min.js
mui.view.js
vue.min.js
easemob.im-1.0.5.js
jquery-1.11.1.js
json2.js
strophe-custom-2.0.0.js
login.html
manifest.json
myinfo.html
news_main.html
news_sub.html
news_view.html
regDevice.html
setserverinfo.html
setting.html
UnitSelect.html
UnitSelect_Chehui.html
heyi_auditinfo.html
heyi_auditinfoview_no.html
heyi_main.html
heyi_sub.html
heyi_view.html
heyi_ys_auditinfoview.html
heyi_ys_main.html
heyi_ys_sub.html
heyi_ys_view.html
heyq_info.html
heyq_main.html
heyq_sub.html
heyq_view.html
heyq_ys_DelayInfo.html
heyq_ys_main.html
heyq_ys_sub.html
heyq_ys_view.html
mainSheng.html
myduban_main.html
myduban_sub.html
myduban_view.html
pai-sub.html
pai_main.html
pai_view.html
publish_main.html
publish_sub.html
publish_view.html
static_dep_view.html
static_dy_view.html
static_lx_view.html
statistic_main.html
ShouLi_view.html
ShouLi_whf_main.html
ShouLi_whf_sub.html
ShouLi_yhf_main.html
ShouLi_yhf_sub.html
ShouLi_ysh_main.html
ShouLi_ysh_sub.html
ShouLi_yth_main.html
ShouLi_yth_sub.html
UnitSelect.html
UnitSelect_Chehui.html
dubantixing_main.html
dubantixing_sub.html
dubantixing_view.html
heyi_auditinfo.html
heyi_sub.html
heyi_view.html
mainShi.html
myduban_sub.html
myduban_view.html
pai-sub.html
pai_view.html
shenhec_main.html
shenhec_sub.html
shenhec_view.html
shenhec_viewfj.html
static_dep_view.html
static_dy_view.html
static_lx_view.html
toLing_main.html
toLing_sub.html
toLing_view.html
zbUnitSelect.html
zbUnitSelect_Chehui.html
zbmyduban_main.html
zbmyduban_sub.html
zbmyduban_view.html
zbpai-sub.html
zbpai_main.html
zbpai_view.html
static-view.html
detail.html
dev-main.html
dev-sub.html
dev-view.html
forget_password.html
iconfont.css
listview.html
main.html
main_copy.html
publish_main.html
publish_sub.html
publish_view.html
reg.html
tempForm.html
unlock.html
ShouLi_view.html
dubantixing_sub.html
dubantixing_view.html
mainXian.html
static-view.html
static_dep_view.html
static_dy_view.html
static_lx_view.html
toLing_sub.html
toLing_view.html
eje3cnc